Strac MCP DLP — PII/PHI/PCI & secret redaction for AI agents (MCP)

An open-source Model Context Protocol server that gives any AI agent — Claude, Cursor, VS Code, your own — a way to find and strip sensitive data before it reaches the model.

Point your agent at it, and redact_text turns

Please onboard the user with SSN 123-45-6789 and email jane@acme.com

into

Please onboard the user with SSN [REDACTED] and email [REDACTED]

...along with a structured list of what was found. It works the same on images, PDFs and scanned documents.

This is a thin client over the Strac DLP API. Bring your own API key; all detection and redaction happens server-side at Strac.

Why

Agents are now wired into inboxes, ticketing systems, CRMs, databases and file stores. Every MCP tool call is a chance for an SSN, a card number, a patient record or an AWS key to be pulled into a prompt — and from there into a model provider's logs, a vector store, a Slack summary or a support ticket.

Filtering that data after the model has seen it is too late. This server puts the check in front of the model: detect first, redact, then let the agent reason over text that no longer carries the sensitive values.

This server is one door into Strac

Redacting a string you hand it is the smallest thing Strac does. The product is coverage: connect Strac to the SaaS and cloud apps where your sensitive data already lives, and it discovers, classifies, redacts and remediates it there — continuously, under your policies, with an audit trail — rather than waiting for someone to paste it into a prompt.

Slack, Google Workspace, Microsoft 365, Salesforce, Zendesk, Box, Dropbox, Jira, Confluence, GitHub, Notion, OneDrive, SharePoint, Snowflake, Databricks, BigQuery, Postgres, MongoDB, AWS, Azure, GCP, browsers and endpoints — 60+ integrations, agentless, no code to write.

That matters most when those systems are reached over MCP. When an agent — Claude Code, Claude Desktop, Cursor, GitHub Copilot, OpenAI Codex — pulls a Salesforce record or a Drive file through an MCP connector, Strac redacts the sensitive data inline, before the agent receives it. That is the difference between asking an agent to redact and enforcing it whether or not it asks.

strac.io/mcp-integrations is that product. This repo is its developer-facing sliver: the same detection engine, reachable from any MCP client, for when you want to sanitise a string or a file yourself.

Every MCP invocation your agents make — tools called, files read, the identity behind the prompt — captured and inspected.

60-second quickstart

1. Install

pip install strac-mcp-dlp

2. Request an API key

Request a key, or email hello@strac.io.

Keys are prefixed sk_live_ (production) or sk_test_ (sandbox); the server picks the matching endpoint automatically.

3. Add it to your MCP client

Claude Desktop — ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows:

{
  "mcpServers": {
    "strac-dlp": {
      "command": "strac-mcp-dlp",
      "env": {
        "STRAC_API_KEY": "sk_live_your_key_here"
      }
    }
  }
}

Claude Code:

claude mcp add strac-dlp --env STRAC_API_KEY=sk_live_your_key_here -- strac-mcp-dlp

Cursor — .cursor/mcp.json in your project, or ~/.cursor/mcp.json globally: use the same block as Claude Desktop.

4. Restart your client and ask it to redact something

Use Strac to redact this before I paste it into the ticket: "Customer Jane Doe, SSN 123-45-6789, card 4111 1111 1111 1111."

No install at all, if you have uv:

{
  "mcpServers": {
    "strac-dlp": {
      "command": "uvx",
      "args": ["strac-mcp-dlp"],
      "env": { "STRAC_API_KEY": "sk_live_your_key_here" }
    }
  }
}

See examples/ for ready-to-copy config files.

Tools

• redact_text

  • Redact PII, PHI, PCI and secrets out of a block of text, returning the sanitised string plus what was found
  • Inputs:
    • text (string): the text to redact
    • redact_field_mode (string, optional): REDACTED (default), BLANK, MASK_SEVEN_X or TOKEN_LINK_PLAINTEXT
    • include_matched_text (boolean, optional): also return the raw sensitive values. Off by default
  • Call it before putting untrusted or user-supplied text into a prompt, a log line, a ticket or any downstream system
  • redact_text(text="SSN 123-45-6789") → "SSN [REDACTED]"

• detect_sensitive_data

  • Report which sensitive data types are present in text, without changing it
  • Inputs:
    • text (string): the text to scan
    • include_matched_text (boolean, optional): also return the raw values. Off by default
  • Use it to decide whether text is safe to send onward
  • detect_sensitive_data(text="call me at jane@acme.com") → EMAIL

• detect_file

  • Scan a local file — image, PDF, scan, config or source — using Strac OCR and classifiers
  • Inputs:
    • path (string): path to the file to scan
    • include_matched_text (boolean, optional): also return the raw values. Off by default
  • The file is never modified
  • detect_file(path="./w2.pdf") → TAX_ID_NUMBER, NAME, ADDRESS

• redact_file

  • Write a redacted copy of a local file to disk
  • Inputs:
    • path (string): path to the file to redact
    • output_path (string, optional): where to write the copy. Defaults to a .redacted suffix beside the original. Pointing it at the source is refused
    • overwrite (boolean, optional): allow replacing an existing destination. Off by default
  • The original is never modified
  • redact_file(path="./w2.pdf") → ./w2.redacted.pdf

• detokenize

  • Resolve Strac vault tokens (tkn_…) back to their original values, for authorised callers
  • Inputs:
    • token_ids (string[]): the token identifiers to resolve. Maximum 10 per call
  • Requires an IP-allowlisted server-to-server key in live mode
  • detokenize(token_ids=["tkn_abc"]) → "111-22-3333"

Redaction styles

redact_text takes a redact_field_mode:

Redaction that doesn't leak

By default these tools return the types and positions of what they found, not the values:

{
  "redacted_text": "Please onboard the user with SSN [REDACTED]",
  "detection_count": 1,
  "data_element_types": ["TAX_ID_NUMBER"],
  "detections": [{ "type": "TAX_ID_NUMBER", "begin_index": 33, "end_index": 44, "length": 11 }]
}

Returning the matched text alongside the redacted text would hand the model exactly the data you just removed. Pass include_matched_text=true when a caller genuinely needs the raw values.

What gets detected

Strac ships 191 built-in data elements across 10 categories, plus custom elements you define with regex or your own trained model:

Every element named individually: Strac Catalog of Sensitive Data Elements.

Detection runs on text and, via OCR, on PDFs, JPEGs, PNGs, DOCX, XLSX, screenshots and .msg email files — which is what detect_file and redact_file reach.

One caveat worth setting expectations on: the type values these MCP tools return depend on which endpoint answered, and the two use different vocabularies for the same element. A US Social Security Number comes back as TAX_ID_NUMBER from redact_text and as SOCIAL_SECURITY_NUMBER from detect_sensitive_data — which additionally reports SSN under reported_element_types. Both vocabularies are surfaced as returned rather than normalised, so nothing is invented on your behalf. Which elements are detected at all depends on what is enabled for your account; the full catalog above is what runs across your connected apps, where policies, remediation and audit live.

Configuration